A flaw in the SubjectDnX509PrincipalExtractor causes certain malformed X.509 certificate Common Name values to be misread as the username, allowing a crafted certificate to impersonate another user. This results in the attacker assuming the identity of a legitimate user and gaining the permissions associated with that account.

Spring Security versions 5.7.0 through 5.7.24, 5.8.0 through 5.8.26, 6.3.0 through 6.3.17, 6.4.0 through 6.4.17, and 6.5.0 through 6.5.10 are affected.

The CVSS score of 6.8 indicates moderate severity. Because EPSS is not available the likelihood of exploitation is uncertain, and the vulnerability is not listed in CISA KEV, implying no known widespread attacks. An attacker with the ability to present an X.509 client certificate to a Spring Security‑enabled application that uses client certificate authentication can exploit this flaw by crafting a certificate whose Common Name is interpreted as a different user's principal, thereby impersonating that user.